Overview

overview

9

Static

static

7

a9e66bd4bc...84.exe

windows7_x64

9

a9e66bd4bc...84.exe

windows10-2004_x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a9e66bd4bc9e965c2df6cd98992c6b9873c1a3cc23e8a0d809b92c444f7f1c84

  • Size

    2.7MB

  • Sample

    220212-bxh2dagadq

  • MD5

    175d34c56247598761c5f65b547665ff

  • SHA1

    1dbb68bc972c440b3d34bd2398f975e335b66e84

  • SHA256

    a9e66bd4bc9e965c2df6cd98992c6b9873c1a3cc23e8a0d809b92c444f7f1c84

  • SHA512

    53dea2a52acf83c944e105ebb5a5d1c52c6e5808076ae19c6b395fa1f85a61dba13e8050008704224481c509e067acb812a8a09212d1c3b6a716a12536039ae3

Score
9/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      a9e66bd4bc9e965c2df6cd98992c6b9873c1a3cc23e8a0d809b92c444f7f1c84

    • Size

      2.7MB

    • MD5

      175d34c56247598761c5f65b547665ff

    • SHA1

      1dbb68bc972c440b3d34bd2398f975e335b66e84

    • SHA256

      a9e66bd4bc9e965c2df6cd98992c6b9873c1a3cc23e8a0d809b92c444f7f1c84

    • SHA512

      53dea2a52acf83c944e105ebb5a5d1c52c6e5808076ae19c6b395fa1f85a61dba13e8050008704224481c509e067acb812a8a09212d1c3b6a716a12536039ae3

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks